Give the code a named temporary owner, then choose one of three paths: fix it, isolate it, or retire it. Put an expiry on any accepted risk. Findings in unowned code do not get fixed by waiting, because nobody feels responsible, and the count only grows.
Why unowned code is a special case
A normal finding goes to a team. Here there is no team. Original authors have moved, the service still runs, and nobody wants the page when it breaks. Scanners keep reporting, and the tickets age.
Treat the missing owner as the first finding. Until it is resolved, nothing else on that code will move.
Step 1: find out what it is
Gather facts quickly:
- What does it do, and who calls it?
- Is it exposed to the internet or only internal?
- What data does it touch?
- Who last committed, and is that person still around?
If you cannot answer, you have your first task: a short discovery, with a deadline.
Step 2: choose a path
| Path | When | What it means |
|---|---|---|
| Fix | Still needed, changes are small | Assign an owning team, upgrade dependencies, add tests |
| Isolate | Needed, but risky to change | Restrict network access, reduce permissions, add monitoring |
| Retire | Little or no use | Confirm no callers, turn it off, archive the repo |
Retirement is often the cheapest security improvement. Many unowned services have no real users. Turn traffic off for a trial period before deleting.
Step 3: assign a temporary owner
Pick a team with related knowledge and make the assignment explicit, in writing, with a review date. The platform team is a common default. Give them time on the plan, or the assignment is only a label.
Step 4: accept risk with an end date
If you decide not to fix now, record the reason, the compensating controls and an expiry. When the date arrives, someone has to decide again. This keeps accepted risk from turning into permanent risk.
Record what you learn
Add the code to your ownership map, whether CODEOWNERS or a service catalog, so future findings route correctly. Check how the code became orphaned, and look for similar repos.
Try it yourself
Click through it at your own pace, or open it full screen. Look for components you would not recognize, which is where unowned code tends to hide.
Safeguard's asset discovery and SBOM and dependency scanning help surface code and dependencies that nobody has claimed. Try the free scan.
Quick check
Is it ever fine to leave unowned code as is?
Only as a recorded, time limited risk acceptance with compensating controls. Otherwise it becomes a standing exposure.
Who pays for the fix?
Agree it with leadership. If a team inherits the code, give them capacity, or the work will not happen.
Last reviewed: 19 October 2026.
